Ransomware attackers threatened employees’ family members or friends at 37% of organizations surveyed for Semperis’ 2026 Ransomware Risk Report. The survey covered 1,200 IT and security professionals at organizations that had experienced at least one successful ransomware attack. “Ransomware has proven to be a great cash-generating activity for criminal syndicates, which have no hesitation about […]
Ransomware attackers threatened employees’ family members or friends at 37% of organizations surveyed for Semperis’ 2026 Ransomware Risk Report. The survey covered 1,200 IT and security professionals at organizations that had experienced at least one successful ransomware attack.
“Ransomware has proven to be a great cash-generating activity for criminal syndicates, which have no hesitation about inflicting both cyber and physical harm,” said Mickey Bresman, Semperis CEO.
Threats reach beyond the workplace
Respondents described threatening messages, stalking and threats of physical harm. Criminals use these tactics to increase pressure on employees and their employers to meet ransom demands.
A quarter said employees or their family members needed medical or psychological treatment because of ransomware threats. Meanwhile, 23% reported swatting, where someone makes a false emergency report to send police to a person’s location.
Doxxing, which involves exposing someone’s personal information online without consent, was another consequence described by respondents. Some employees needed security protection or changed jobs, offices or homes following an attack.
What threats did attackers leverage? (Source: Semperis)
Documenting response roles across the organization and including procedures for threats against people outside the workplace, such as employees’ family members is recommended. Establishing relationships with law enforcement before an incident is also advised.
The personal consequences add to the pressure on staff responding to an attack.
“IT and cybersecurity staff are already dealing with high levels of stress,” says Tim Beasley, Semperis Senior Incident Response Consultant. “A ransomware attack takes that to a whole new level. I’ve seen CISOs literally say, ‘I’m out, I’m done, I can’t do this. It isn’t worth it.’ I’ve seen people walk out the door because leadership thought they mismanaged something that caused the breach to occur. It all takes a mental toll.”
Restoring operations can leave attackers with access
Some 69% of surveyed organizations experienced multiple successful ransomware attacks within the previous year.
Recovering from an incident requires teams to find how criminals entered, remove their access and check the systems being restored. Malware, backdoors and compromised accounts can give intruders a way back into the organization.
Pressure to resume operations can lead businesses to restore services before establishing whether attackers have been removed. That leaves unresolved weaknesses available for another intrusion.
Ransom payments remained common, with 59% of respondents saying their organization paid. Reasons included protecting customer information, limiting disruption and containing reputational damage. Some paid because they could not remove attackers from their environment.
Payment provides no guarantee of recovering data or system access. Receiving a decryption key also does not eliminate the need to rebuild the environment to a trusted state. Decryption tools can be buggy or contain malicious code, and some files may remain unrecoverable.
Restoring access needs its own plan
Attackers targeted or exploited identity systems in 87% of surveyed cases. Services such as Active Directory, Entra ID and Okta manage accounts, sign-ins and permissions across an organization.
Control of these systems can help criminals access connected services, change user privileges and interfere with recovery. Responders need to establish which accounts remain safe and whether permissions have been altered.
Half of the surveyed organizations had dedicated identity backups. A trusted copy of account and permission information helps teams restore access without carrying compromised settings into the rebuilt environment.
Identity recovery also affects the order in which services can return. Employees need working accounts to use restored applications, and administrators need trusted access to manage them.
Respondents identified evolving cyber threats, outdated systems, technical debt and regulatory demands as leading challenges to keeping operations running and recovering from attacks. They also cited outdated crisis plans, undefined roles and responsibilities, and communication gaps between teams as barriers during incident response.
